Nginx配置SSL（windows系统）

75 阅读 0 评论 50 点赞

我是靠谱客的博主勤奋魔镜，最近开发中收集的这篇文章主要介绍Nginx配置SSL（windows系统），觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

1，安装openssl

官网地址：
https://slproweb.com/products/Win32OpenSSL.html

2，生成证书文件

openssl genrsa -idea -out [证书名].key 1024

控制台：
Generating RSA private key, 1024 bit long modulus (2 primes)
…+++++
…+++++
e is 65537 (0x010001)
Enter pass phrase for jesonc.key:
Verifying - Enter pass phrase for jesonc.key:输入密码

openssl.exe req -new -key [证书名].key -out [证书名].csr

控制台：

Enter pass phrase for jesonc.key:输入密码
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [AU]:输入所在国家名
State or Province Name (full name) [Some-State]:输入所在省份
Locality Name (eg, city) []:输入所在城市
Organization Name (eg, company) [Internet Widgits Pty Ltd]:输入公司名称（英文）
Organizational Unit Name (eg, section) []:输入部门名称（英文）
Common Name (e.g. server FQDN or YOUR name) []:输入网站域名
Email Address []:输入邮箱
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:不输入
An optional company name []:不输入

openssl x509 -req -days 3650 -in [证书名].csr -signkey [证书名].key -out [证书名].crt

控制台：
Signature ok
subject=C = **, ST = **, L = **, O = **, OU = **, CN = **, emailAddress = **
Getting Private key
Enter pass phrase for jesonc.key:输入密码

3，配置nginx

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

server {
    listen       443 ssl;
    server_name  localhost;

    ssl_certificate [路径]/jesonc.crt;
    ssl_certificate_key [路径]/esonc.key;
    ......
 }

4，【问题】windows系统无法启动nginx

windows系统配置完ssl之后，在启动nginx的时候有可能无法启动，而是在error.log中输入这样一段话：

the event "ngx_master_16332" was not signaled for 5s

解决方案是将密码刨掉，做法：

openssl rsa -in jesonc.key -out jesonc.key.unsecure

然后这样配置nginx:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

server {
    listen       443 ssl;
    server_name  localhost;

    ssl_certificate [路径]/jesonc.crt;
    ssl_certificate_key [路径]/esonc.key.unsecure;
    ......
 }